Hello.
I'm trying to send log from heavy forwarder to 2 indexes. One is receiving logs, but the second is not.
Here is the props.conf file:
[test]
TRANSFORMS-routing=errorRouting,successRouting
Here is the outputs.conf file:
[tcpout:errorGroup]
server = 35.196.124.233:9997
[tcpout:successGroup]
server = 34.138.8.216:9997
Here is the transforms.conf file:
[errorRouting]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=errorGroup
[successRouting]
REGEX=.
DEST_KEY=_TCP_ROUTING
FORMAT=successGroup
What could be the problem?
Thank you.
1. You're not trying to route to two indexes but to two indexers.
2. If you want the event to be sent to both those groups, you're gonna have to clone the event (maybe you can do it easier with ingest action). With your configuration the second transform overwrites the result of the first one so all your events will go to successGroup.